1. INFORMATION ON THE PROCESSING OF PERSONAL DATA
Your data security is important to us, and we therefore attach great importance to the responsible handling of your personal data. Below you can read how Envidan A/S and the other group companies (hereinafter “Envidan”, “we”, “us” or “our”) process personal data about you when we act as data controller. You can also read about the rights you have in connection with our processing
2. ENVIDAN’S ROLE AS DATA CONTROLLER
In connection with the operation of our company, we process a number of personal data. We do this so that we can serve you in the best possible way. We collect and process mainly ordinary (non-sensitive) personal data.
If you have any questions about our processing of your personal data, you can contact Envidan here:
Envidan A/S
CVR: 183 343 05
Vejlsøvej 23
8600 Silkeborg
Danmark
Head of Legal:
Navn: Birgitte Grønlund Møller
Telefon: 30905976
E-mail: bgm@envidan.dk
If you wish to contact us regarding our processing of your personal data, you can do so at: gdpr@envidan.dk
3. WHAT PERSONAL INFORMATION WE COLLECT AND THE PURPOSE
We process personal data about you in a number of different situations. Read more about our processing in the different situations below
Visitors to Envidan’s websites and users of Envidan’s online services
3.1.1 Dataresponsibility
When you visit Envidan’s websites (e.g. www.envidan.com) or use our other online services (e.g. on LinkedIn, Facebook and Instagram), Envidan is the data controller for the personal data we receive and process about you. Envidan is obliged to inform you as a visitor about several topics and rights, cf. Article 13, paragraph 1 of the General Data Protection Regulation.
3.1.2 Processing of personal data and purposes
Envidan processes information about your IP address as well as information about your computer, device and browser.
We also process information about your visit (e.g. information about how you access our websites, how you navigate around them, which pages you visit, content you view, your searches, advertisements you have seen, etc.). This personal data is collected through cookies, log files and other technologies (you can read more about our use of cookies here: http://www.envidan.com/da/complience/cookiepolitik).
We also process personal data that you provide to us in connection with your use of the website or our online services, e.g. when you use our online contact form, including your name, telephone number, email address, product interest, and other information you provide to us.
We use your personal data to make relevant products, deliveries, benefits and services (“Services”) available to you and to improve your experience of our websites and online services as well as the Services we offer. We also use the personal data to show you content on our and other sites based on your activities and preferences, and to limit the number of times you see the same content.
Our legal basis for the processing of your personal data when visiting our website is our legitimate interests in making our website (and online services) available to you (GDPR Article 6, paragraph 1, letter f). Our legal basis for using your personal data through cookies is your consent, cf. GDPR Article 6, paragraph 1, letter a, and the Cookie Order § 3.
3.1.3 Storage and deletion
We retain personal data collected in connection with your visit to our website for as long as you use our products or services or have an account with us. We reserve the right to retain your personal data for up to 12 months after your visit to our website or after the end of the use of the above cases.
3.1.4 Your rights
In cases where the legal basis is your consent, cf. Article 6, paragraph 1, letter a of the General Data Protection Regulation, you have the following rights:
- Right to access. You have the right to access the personal data we process on your behalf.
- Right to rectification. You have the right to have inaccurate personal data corrected and incomplete personal data completed.
- Right to erasure. In certain cases, you have the right to have personal data about you deleted before the time when we would normally delete your personal data.
- Right to restriction of processing. In certain cases, you have the right to have the processing of your personal data restricted. If you have the right to have the processing restricted, Envidan may only process the personal data – with the exception of storage – with your consent, or for the purpose of legal claims that can be established, asserted or defended, or to protect a person or important public interests.
- Right to data portability. In certain cases, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have this personal data transferred from one data controller to another..
- Right to object. In certain cases, you have the right to object to our processing of your personal data, and always if the processing is for the purpose of direct marketing.
You can file a complaint at any time with the Danish Data Protection Authority, which has the following address and e-mail address
Datatilsynet
Carl Jacobsens vej 35
2500 Valby
Telefon +45 33 19 32 00
E-mail dt@datatilsynet.dk
However, we hope that you will contact us before filing a complaint with the Danish Data Protection Agency. This can be done for the information that is found under point 2 of this privacy policy
In cases where the legal basis is Article 6(1)(f) of the General Data Protection Regulation, you have the same rights as mentioned above, with the exception of No. 5, the right to data portability.
3.1.5 Sub-processors
Envidan uses the following sub-processors, cf. GDPR Art. 28, para. 1
| Name | Address | Description |
| Hubspot | ||
| Microsoft Azure | One Microsoft Place South Country Business Park Leopardstown Dublin 18 | Storage and operation of applications and data |
Envidan uses sub-processors in the USA, which is an unsafe third country. Envidan only uses sub-processors in the USA that are certified and approved according to the EU-US Data Privacy Framework, which is also considered a sufficient basis for transfer.
When you visit our website, we use Cookies. Here, your information is shared with Google.
Here we refer to our Cookie Policy: https://www.envidan.com/da/compliance/cookiepolitik/
3.2 Clients
3.2.1 Data responsibility
Envidan is the data controller for the data we receive on behalf of our customers, unless the customer has further instructions and purposes. In cases where Envidan is to be considered the data controller, Envidan is obliged to provide information on a number of topics and rights, cf. GDPR Article 13, paragraph 1.
3.2.2 Processing of personal data and purposes
In order for you to be a customer with us, it is necessary for us to collect the following personal data about you: name, username, address, email, telephone number, CVR number, signature, location information. We collect personal data about customers for the following purposes:
- Processing your purchase and delivery of our service
- Administration of your relationship with us
We collect this information on the following legal basis:
- Processing takes place on the basis of fulfillment of the contract with the customer and Envidan, cf. art. 6, para. 1, letter b
3.2.3 Storage and deletion
We store the information for the period permitted by law, and we delete it when we no longer have a legitimate purpose. The period depends on the nature of the information and the reason for storage. Envidan is, according to the Danish Accounting Act, obliged to store certain personal data for five years after the customer relationship ends.
3.2.4 Your rights
As a data subject, you have a number of rights under the General Data Protection Regulation. These are described under section 3.1.4 of this privacy policy
The basis of the relationship between Envidan and its customers is Article 6(1)(b) of the General Data Protection Regulation. This means that you as a data subject do not have the right to object.
3.2.5 Sub-processors
Envidan uses sub-processors in the processing of personal data that is collected and processed.
Envidan uses the following sub-processors, cf. the General Data Protection Regulation, art. 28, paragraph 1
| Name | Address | Description |
| Hubspot | ||
| Microsoft Azure | One Microsoft Place South Country Business Park Leopardstown Dublin 18 | Storage and operation of applications and data |
Envidan uses sub-processors in the USA, which is an unsafe third country. Envidan only uses sub-processors in the USA that are certified and approved according to the EU-US Data Privacy Framework, which is considered to be a sufficient basis for transfer.
3.3 Potential customers
3.3.1 Dataresponsibility
Envidan is the data controller for the data we receive in connection with reaching an agreement with potential customers, unless the customer still has the instructions and the purpose.
In cases where Envidan is to be considered as the data controller, Envidan is obliged to provide information on a number of topics and rights, cf. GDPR Article 13, paragraph 1.
3.3.2 Processing of personal data and purposes
In order for you to become a customer with us, it is necessary for us to collect the following personal information about you: Name, company, email, telephone number, address and CVR number.
The processing of personal information is based on Article 6(1)(f) of the General Data Protection Regulation.
We collect personal information about potential customers for the following purposes:
- Possible future cooperation or purchase transaction
- Administration of your relationship with us
We collect this information on the following legal basis:
- The company’s legitimate interest in collecting and storing the information of potential customers is to facilitate communication between the two parties. Only information that has been published by the potential customer himself is stored.
3.3.3 Storage and deletion
We store the information for the period permitted by law and we delete it when it is no longer necessary. The period depends on the nature of the information and the reason for the storage. Typically, information regarding potential customers will be deleted after the agreement has ended or when the correspondence is deemed no longer relevant. However, the information will be stored as long as the customer relationship is still ongoing.
Information about potential customers will be deleted no later than 6 months after the last contact or upon request, whichever comes first.
3.3.4 Your rights
As a data subject, you have a number of rights under the General Data Protection Regulation. These are described under section 3.1.4 of this privacy policy
The basis of confidentiality between Envidan and its potential customers is the General Data Protection Regulation, art. 6, para. 1, letter b.
This means that you as a data subject do not have the right to object. See section 3.1, no. 6.
3.3.5 Underdatabehandlere
Envidan uses sub-processors in the processing of personal data that is collected and processed.
Envidan uses the following sub-processors, cf. the General Data Protection Regulation, art. 28, paragraph 1.
| Name | Address | Description |
| Hubspot | ||
| Microsoft Azure | One Microsoft Place South Country Business Park Leopardstown Dublin 18 | Storage and operation of applications and data |
Envidan uses sub-processors in the USA, which is an unsafe third country.
Envidan only uses sub-processors in the USA that are certified and approved according to the EU-US Data Privacy Framework, which is considered to be a sufficient basis for transfer.
3.4 Recipients of marketing
3.4.1 Data responsibility
When you receive marketing, including newsletters from Envidan, we process personal data about your name, email address, product interest, title and telephone number. We also process information about your preferences in relation to marketing or communication, your use of the marketing we send you (including, for example, whether you have opened an email from us, whether the email has been read, and which links you have opened), as well as information that you otherwise provide to us. Envidan is the data controller and is therefore obliged to provide information about a number of topics and obligations, cf. Article 13, paragraph 1 of the General Data Protection Regulation.
3.4.2 Processing of Personal Data and Purposes
We process your personal data for the purpose of marketing our company and the company’s services, creating and administering you as a subscriber to marketing. We use the personal data about your preferences and your use, to understand the way you as a customer act and react to our marketing and to improve our marketing to customers and future customers.
This is direct marketing, where we address people who have given their consent, cf. Section 10 of the Danish Marketing Act. Envidan therefore only sends material by e-mail, text message or via other electronic channel to which you have consented.
We use your personal data for the purpose of displaying content on our websites, based on the activities and preferences you have. Personal data is also used to limit the number of times you see the same content and to measure the effectiveness of Envidan’s content and marketing.
Our legal basis under the General Data Protection Regulation for processing and storing your personal data in this regard is Article 6(1)(a).
3.4.3 Storage and deletion
We store personal data as long as we have your consent. If you withdraw your consent, Envidan reserves the right for a period of two months to delete all your personal data.
3.4.4 Your rights
As a data subject, you have a number of rights under the General Data Protection Regulation. These are described in section 3.1.4 of this privacy policy.
Since our legal basis for processing and storing your personal data is Article 6(1)(a) of the General Data Protection Regulation (GDPR), you have all the rights that follow from the General Data Protection Regulation and that are mentioned and described in section 3.1.4
3.4.5 Sub-processors
Envidan uses the following sub-processors, cf. the General Data Protection Regulation, Article 28, paragraph 1.
| Name | Address | Description |
| Hubspot | ||
| Microsoft Azure | One Microsoft Place South Country Business Park Leopardstown Dublin 18 | Storage and operation of applications and data |
3.5 Partners and/or suppliers to Envidan
3.5.1 Data responsibility
When you are a partner or supplier to Envidan or are a contact person at a partner/supplier, we process personal data about your name, business address, work telephone number, email address, title, as well as publicly available information and other information that you provide to us.
3.5.2 Processing of personal data and purposes
We process personal data for contract management purposes and to receive goods and services from our suppliers and partners, and where relevant to fulfill agreements with our customers.
Our legal basis for processing is the agreement with you, cf. GDPR Article 6(1)(b) or our legitimate interests in maintaining the relationship with you/the company you represent as a partner/supplier, cf. GDPR Article 6(1)(f).
3.5.3 Storage and deletion
We store the above information about partners and/or suppliers for up to 5 years after the end of the collaboration. After that, the personal data will be deleted.
3.5.4 Your rights
As a data subject, you have a number of rights under the General Data Protection Regulation. These are described in section 3.1.4 of this privacy policy.
Since our legal basis is the General Data Protection Regulation, Article 6, paragraph 1, letters b and f, you do not have the right to object or data portability, which is mentioned and described in section 3.4.1.
3.5.5 Sub-processors
Envidan uses the following sub-processors, cf. the General Data Protection Regulation, Article 28, paragraph 1.
| Name | Address | Description |
| Hubspot | ||
| Microsoft Azure | One Microsoft Place South Country Business Park Leopardstown Dublin 18 | Storage and operation of applications and data |
3.6 Job seekers
3.6.1 Data responsibility
Envidan is the data controller and is therefore obliged to provide information on a number of topics and rights, cf. Article 13, paragraph 1 of the General Data Protection Regulation.
3.6.2 Processing of Personal Data and purposes
When we receive your application, it will be read and processed according to the following regulations: The application with attachments will be shared internally with relevant personnel in the recruitment process.
In connection with the recruitment process, Envidan may request a copy of the criminal record.
In addition, Envidan may ask candidates for selected positions to complete a personality test. The results of this will be processed by Envidan’s HR department and the relevant department manager.
Envidan uses the information to assess whether Envidan wishes to offer you employment, and to communicate with you in connection with the recruitment process.
Your information is stored in Envidan’s HR system.
Only relevant managers, the HR department and IT administrators have access to your information with personal passwords.
If you are employed by Envidan, your information will be stored in accordance with Envidan’s personal data policy for employees, which you can find on Envidan’s intranet.
Personal information that arises in the recruitment process will be processed on the following basis for processing: Consent; It is assumed that in connection with the applicant providing his/her information to Envidan, the information is processed based on the applicant’s consent, and the processing will be stopped at the time the consent is withdrawn.
Envidan is based on the General Data Protection Regulation, Article 6, Paragraph 1, Letter f for general information, as well as Article 9, Paragraph 2, Letter f and Section 12, Paragraph 1 of the Danish Data Protection Act.
3.6.3 Storage and deletion
Applications from candidates who are not hired are generally stored for 6 months after the rejection. EnviDan obtains consent from the applicant to store the application in the recruitment system.
During the application process, you have the option to consent to your data being stored in our subject bank for up to 12 months. This storage only occurs if you do not get the job. You will be contacted before the end of the 12 months with the option to extend your consent for a further 12 months. If you have not given or extended your consent, your data will be automatically deleted 6 months after you have received a rejection.
In certain cases, Envidan may also disclose your personal data if required by law, a court decision or applicable legislation.
In the case of unsolicited applications, we store your application with attachments for 6 months, after which they will be deleted. However, you have the option to consent to the application being stored for up to 12 months. You will be contacted before the end of the 12 months with the opportunity to extend your consent for an additional 12 months. If you have not given or extended your consent, your data will be automatically deleted 6 months after you have received a refusal.
Your consent is voluntary, and you can withdraw it at any time by contacting us using the contact details above.
3.6.4 Your rights
As a data subject, you have a number of rights under the General Data Protection Regulation. These are described in section 3.1.4 of this privacy policy.
Since our legal basis is the General Data Protection Regulation, Article 6(1)(f), you do not have the right to data portability, which is mentioned and described in section 3.4.1.
3.6.5 Sub-processors
Envidan uses the following sub-processors, cf. the General Data Protection Regulation, Article 28, paragraph 1.
| Name | Address | Description |
| Hubspot | ||
| Microsoft Azure | One Microsoft Place South Country Business Park Leopardstown Dublin 18 | Storage and operation of applications and data |
3.7 Participants at Envidan’s events
3.7.1 Data responsibility
When you are a participant at an event that Envidan organizes, Envidan is the data controller and is therefore obliged to provide information about a number of topics and rights, cf. the General Data Protection Regulation, Article 13, paragraph 1.
Events include, but are not limited to, webinars, events, homecoming meetings, events for students, workshops, fairs, construction site visits, etc.
3.7.2 Processing of personal data and purposes
When you register and participate in events held by Envidan or other organizers where Envidan participates and we thereby receive your personal data, we process personal data about your name, telephone number, email address, which events you participate in.
We process this personal data for the purpose of administering the event, in order to keep you updated on a regular basis regarding practical information and for security reasons, as well as to be able to send you relevant material and subsequently send an evaluation of the event.
If you have received and signed a consent statement for an event in which you consent to Envidan being allowed to use images and videos in which you appear, the legal basis is the Data Protection Regulation, Article 6, Paragraph 1, Letter a. You can – as written in the consent statement – always withdraw your consent.
Our basis for the processing of your personal data, which is not consent-based, is our legitimate interests in holding events, cf. the Data Protection Regulation, Article 6, Paragraph 1, Letter f and the Marketing Act, Section 10.
3.7.3 Storage and deletion
If the basis is a declaration of consent, your personal data will be deleted either when you withdraw your consent or after the end of the marketing period. After the end of the marketing period, your personal data will be deleted after 6 months at the latest.
In the case of recordings – including webinars – the recording will be deleted after 12 months. If the recordings are subsequently sent to the participants, the recordings may not be sent to third parties without prior consent from Envidan. If there is a chat function for the webinar, these will be deleted when Envidan no longer has a legitimate purpose for processing personal data that may be mentioned in the chat.
When registering for other events, your information will be stored for 5 years.
3.7.4 Your rights
As a data subject, you have a number of rights under the General Data Protection Regulation. These are described in section 3.1.4 of this privacy policy
Since our legal basis is Article 6(1)(f) of the General Data Protection Regulation, you do not have the right to data portability, which is mentioned and described in section 3.4.1.
3.7.5 Sub-processors
Envidan uses the following sub-processors, cf. the General Data Protection Regulation, Article 28, paragraph 1.
| Name | Address | Description |
| Hubspot | ||
| Microsoft Azure | One Microsoft Place South Country Business Park Leopardstown Dublin 18 | Storage and operation of applications and data |
4. General
4.1 DATA INTEGRITY AND SECURITY
When your personal data is no longer needed, we will ensure that it is deleted in a secure manner. It is our policy to protect personal data by taking adequate technical and organizational security measures.
We have implemented security measures to ensure data protection for all personal data that we process. We regularly conduct internal follow-ups on the adequacy and compliance with policies and measures.
4.2 Disclosure of personal data
Envidan may disclose your personal data to other suppliers and/or service providers in connection with the normal operation of our business and to our affiliated companies.
Envidan may also disclose your personal data to a public authority in situations where we are specifically obliged to disclose your personal data pursuant to legislation and notification obligations to which we are subject.
We try to limit the disclosure of data in a personally identifiable form and thus the disclosure of information that can be attributed to you personally.
5. UPDATE OF OUR PRIVACY POLICY
From time to time, it will be necessary for us to update this Privacy Policy. We regularly review our Privacy Policy to ensure that it is up-to-date, accurate and in accordance with applicable laws and principles for the processing of personal data. We will publish new versions on our website.
This policy has version no. 4.0 and is effective from April 1, 2024.